10Web Social Photo Feed: PHP Object Injection by Contributor-level users
Summary
The WordPress plugin 10Web Social Photo Feed up to and including version 1.5.6 contains a PHP Object Injection flaw (CWE-502) that results from unsafe deserialization of untrusted data. An attacker with a Contributor-level account can exploit it over the network to manipulate how the site processes data, with a possible impact on confidentiality, integrity and availability. No fixed version or vendor workaround is known yet, and no active exploitation or public exploit is recorded.
Affected
- 10Web Social Photo Feed (WordPress plugin, slug wd-instagram-feed) up to and including 1.5.6
- Requires an account with at least Contributor privileges
Fixed in
Unknown. No patched version has been published at the time of writing. Check the Patchstack advisory and the WordPress.org changelog for wd-instagram-feed.
Workaround
- No vendor workaround known.
- Patchstack has published a virtual patch (mitigation rule) that blocks attacks until an official fix is available.
- Disabling the plugin removes the exposure.
Exploitation
- No known exploitation in the wild.
- No public exploit indexed (VulDB, OffSeq, Metasploit, Exploit-DB).
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- Patchstack rates the issue as medium priority and expects exploitation to increase.
Our recommendation
- Check whether the plugin is installed and which version is active.
- Disable the plugin if the Instagram feed is not business-critical.
- Enable the Patchstack mitigation rule or a comparable WAF rule if available.
- Review and reduce Contributor and higher accounts, and remove unknown ones.
- Keep WordPress core and all plugins up to date, and monitor the Patchstack entry for a fixed release.
- Note that the CVSS score differs between sources (8.8 by the CNA, 6.3 by VulDB), so prioritise based on your own exposure.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- VulDB entry vuldb.com
- OffSeq threat radar radar.offseq.com
- CVE record summary (threatint) cve.threatint.com
- Strix CVE summary www.strix.ai
- WPHive plugin page wphive.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:07.
Original description (NVD)
Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.